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AMENDMENTS TO CLAIMS 



Claim 1 (currently amended): A digital signature cryptographic method comprising: 
supplying a set S 1 of k polynomial functions as a public-key, the set 
SI including the functions P,(x,,...,Xn+v, yi,...,yk),..., Pk(xi,...,Xn+v, yi,...,ykX where k, 
V, and n are integers, Xi,...,Xn+v variables of a first type, yi,...,yk k 

variables of a second type, and the set SI is obtained by applying a secret key 
operation on a set S2 of k polynomial functions 
P'i(ai,...,an+v,yb...,ykX..-,P'k(ai,...,an+v,yb...,yk) where ai,...,an+v are n+v variables 
which include a set of n "oil" variables ai,...,an, and a set of v "vinegar" variables 

an^i a^-^v , the supplying comprising selecting the number v of "vinegar" variables 

to be greater than the number n of "oil" variables : 
providing a message to be signed; 

applying a hash function on the message to produce a series of k 
values bi,...,bic; 

substituting the series of k values bi,...,bk for the variables yi,...,yk of 
the set S2 respectively to produce a set S3 of k polynomial functions 

P"i(ai,...,an+vX..., P"k(a,,..,,an+v); 

selecting v values a'n+i,...,a'n+v ^ov the v "vinegar" variables 

an+i v?an+v; 

solving a set of equations P"i(ai,...,an,a'n+ivja'n+v)~0?---5 
P"k(ai,...,anja'n+iv5a'n+v)'^0 to obtain a solution for a'i,...,a'n; and 

applying the secret key operation to transform a'i,...,a'n+v to a digital 
signature e,,...,en+v. 

Claim 2 (previously presented): A method according to claim 1 and also comprising 
verifying the digital signature. 

Claim 3 (previously presented): A method according to claim 2 and wherein said 
verifying comprises: 
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obtaining the signature ei,...,en+v> the message, the hash function and 
the public key; 

applying the hash function on the message to produce the series of k 
values bi,...,bk; and 

verifying that the equations P,(e,,...,en+v,bi,...,bk)=0,..., Pk(ei,...,en+v. 
bi,...,bk)=0 are satisfied. 

Claim 4 (previously presented): A method according to claim 1 and v^herein the 
method comprises an HFEV scheme and the set S2 comprises a set f(a) of k 
polynomial functions of the HFEV scheme. 

Claim 5 (previously presented): A method according to claim 1 and wherein the 
method comprises a UOV scheme and the set S2 comprises a set S of k polynomial 
functions of the UOV scheme. 

\ 

Claim 6 (canceled) 

Claim 7 (previously presented): A method according to claim 1 and wherein v is 
selected such that q"' is greater than 2^^, where q is the number of elements of a finite 
field K over which the sets SI, S2 and S3 are provided. 

Claim 8 (previously presented): A method according to claim 1 and wherein said 
supplying comprises obtaining the set SI from a subset 82' of k polynomial 
functions of the set S2, the subset S2' being characterized in that all coefficients of 
components involving any of the yi5...,yk variables in the k polynomial functions 
P'i(ai,...,a„+v,yi,...,yk),...,P'k(ai,...,an+v,yb.-Myk) are zero, and the number v of 
"vinegar" variables is greater than the number n of "oil" variables. 

Claim 9 (previously presented): A method according to claim 8 and wherein the set 
S2 comprises a set S of k polynomial functions of a UOV scheme, and the number v 
of "vinegar" variables is selected to satisfy one of the following conditions: 
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(a) for each characteristic p other than 2 of a field K in an "Oil and 
Vinegar" scheme of degree 2, v satisfies the inequality q^^'"^"' * n"* > 
2"*^, where K is a finite field over which the sets SI, S2 and S3 are 
provided, 

(b) for p = 2 in an "Oil and Vinegar" scheme of degree 3, v is greater 
than n*(l + sqrt(3)) and less than or equal to nV6, and 

(c) for each p other than 2 in an "Oil and Vinegar" scheme of degree 
3, V is greater than n and less than or equal to n"^. 

Claim 10 (previously presented): A method according to claim 8 and wherein the 
set S2 comprises a set S of k polynomial functions of a UOV scheme, and the 
number v of "vinegar" variables is selected to satisfy the inequalities v<n^ and q^^*"^'* 
* n"* >2'*^ for a characteristic p=2 of a field K in an "Oil and Vinegar" scheme of 
degree 2, where K is a finite field over which the sets SI, S2 and S3 are provided 
and q is the number of elements of K. 

Claim 1 1 (original): A method according to claim 1 and wherein said secret key 
operation comprises a secret affine transformation s on the n+v variables ai,...,an+v- 

Claim 12 (original); A method according to claim 4 and wherein said set S2 
comprises an expression including k functions that are derived from a univariate 
polynomial. 

Claim 13 (original): A method according to claim 12 and wherein said univariate 
polynomial includes a univariate polynomial of degree less than or equal to 100,000. 

Claim 14 (original): A cryptographic method for verifying the digital signature of 
claim 1 , the method comprising: 

obtaining the signature ei,.,.,en+v, the message, the hash function and 
the public key; 
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# 



applying the hash function on the message to produce the series of k 
values bi5...5bk; and 

verifying that the equations P,(ei,...,en+v,bi,...,bk)=0,..., Pk(ei,...,en+V5 
bi5...,bk)=0 are satisfied. 

Claim 15 (previously presented): In an "Oil and Vinegar" signature method, an 
improvement comprising using more "vinegar" variables than "oil" variables. 

Claim 16 (previously presented): A method according to claim 15 and wherein a 
number v of "vinegar" variables is selected to satisfy one of the following 
conditions: 

(a) for each characteristic p other than 2 of a field K and for a degree 
2 of the "Oil and Vinegar" signature method, v satisfies the inequality 
q(v-n)-i * ^ 2"^^^ where n is a number of "oil" variables, K is a finite 
field from which the n "oil" variables and the v "vinegar" variables 
are selected, and q is the number of elements of K, 

(b) for p = 2 and for a degree 3 of the "Oil and Vinegar" signature 
method, v is greater than n*(l + sqrt(3)) and less than or equal to nV6, 
and 

(c) for each p other than 2 and for a degree 3 of the "Oil and Vinegar" 
signature method, v is greater than n and less than or equal to n"*. 

Claim 17 (previously presented): A method according to claim 15 and wherein a 
number v of "vinegar" variables is selected to satisfy the inequalities v<n^ and q^"^*"^'* 
* n^ >2'*^ for a characteristic p=2 of a field K in an "Oil and Vinegar" scheme of 
degree 2, where n is a number of "oil" variables, K is a finite field fi-om which the n 
"oil" variables and the v "vinegar" variables are selected, and q is the number of 
elements of K. 



Claim 18 (currently amended): 



A signature generator comprising: 
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a signature input receiver operative to receive a set SI of k 
polynomial functions as a public-key and a message to be signed, the set SI 
including the functions Pi(xi,...,Xn+v, yb-.^ykX--, Pk(xi,...,Xn+v, yb-.^yk), where k, v, 
and n are integers, Xi^.-.^Xn+v are n+v variables of a first type, yb...,yk are k variables 
of a second type, and the set SI is obtained by applying a secret key operation on a 
set S2 of k polynomial functions P'i(ai,...,an4-v,yb.-..ykX-...P'k(ab..Man+v,yi5.",ykX 
where a|,...,an+v are n+v variables which include a set of n "oil" variables ai,...,an, 

and a set of v "vinegar" variables an+i an+v and the number v of "vinegar" variables 

is jgreater than the number n of "oil" variables : and 

a signature processor operatively associated with the signature input 
receiver and operative to perform the following operations: 

to apply a hash function on the message to produce a series of 

k values bi,...,bk, 

to substitute the series of k values bi,...,bk for the variables 
yi5'--5yk of the set S2 respectively to produce a set S3 of k polynomial functions 
P"i(ai5...5an+v)5- • •? P"k(ai5--.,an+v), 

to select V values a'n+i,...,a'n+v for the v "vinegar" variables 

an+iv"»an+v? 

to solve a set of equations P"i(ai,...,an,a'n+i,...,a'n+v)=0>- 
P"k(ai,...,an,a'n+i,. .,a'n+v)^0 to obtain a solution for a'i,...,a'n; and 

to apply the secret key operation to transform a'i,...,a'n+v into a 
digital signature ei,...,en+v 

Claim 19 (previously presented): Apparatus according to claim 18 and also 
comprising a signature verifier operatively associated with the signature processor 
and operative to verify the digital signature. 

Claim 20 (previously presented): Apparatus according to claim 19 and wherein 
said signature verifier is operative to verify the digital signature by performing the 
following operations: 
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obtaining the signature ei,...,en+v5 the message, the hash function and 
the public key; 

applying the hash function on the message to produce the series of k 
values bi,...,bk; and 

verifying that the equations Pi(e,,...,en+v,b,,.,.,bk)=0,..., Pk(ei,...,en+v, 
bi,...,bk)=0 are satisfied. 

Claim 21 (previously presented): Apparatus according to claim 18 and wherein 
the signature processor is operative to perform an HFEV scheme, and the set S2 
comprises a set f(a) of k polynomial functions of the HFEV scheme. 

Claim 22 (previously presented): Apparatus according to claim 18 and wherein 
the signature processor is operative to perform a UOV scheme, and the set S2 
comprises a set S of k polynomial functions of the UOV scheme. 

Claim 23 (canceled) 

Claim 24 (previously presented): Apparatus according to claim 18 and wherein v 
is selected such that is greater than 2^^, where q is the number of elements of a 
finite field K over which the sets SI, S2 and S3 are provided. 

Claim 25 (previously presented): Apparatus according to claim 18 and wherein 
the set SI is obtained from a subset S2' of k polynomial functions of the set S2, the 
subset S2' being characterized in that all coefficients of components involving any 
of the yi5...,yk variables in the k polynomial functions P'i(ai,,..,an+v3yu---3yk)? 
...,P'k(ai,...,an+v?yi5---5yk:) are zero, and the number v of "vinegar" variables is greater 
than the number n of "oil" variables. 

Claim 26 (previously presented): Apparatus according to claim 25 and wherein 
the set S2 comprises a set S of k polynomial functions of a UOV scheme, and the 
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number v of "vinegar" variables is selected to satisfy one of the following 
conditions: 

(a) for each characteristic p other than 2 of a field K in an "Oil and 
Vinegar" scheme of degree 2, v satisfies the inequality q^^'"^"* * n"* > 
2"*^, where K is a finite field over which the sets SI, S2 and S3 are 
provided, 

(b) for p = 2 in an "Oil and Vinegar" scheme of degree 3, v is greater 
than n*(l + sqrt(3)) and less than or equal to r?/6, and 

(c) for each p other than 2 in an "Oil and Vinegar" scheme of degree 
3, V is greater than n and less than or equal to n"*. 

Claim 27 (currently amended): Apparatus according to claim 25 and wherein 
the set S2 comprises a set S of k polynomial functions of a UOV scheme, and the 
number v of "vinegar" variables is selected to satisfy the inequalities v<n^ and q^''""^"* 
* n"* >2^^ for a characteristic p=2 of a field K in an "Oil and Vinegar" scheme of 
degree 2^ [[2, ]] where K is a finite field over which the sets SI, S2 and S3 are 
provided and q is the number of elements of K. 

Claim 28 (previously presented): Apparatus according to claim 18 and wherein 
said secret key operation comprises a secret affine transformation s on the n+v 
variables ai,...,a 

n+v 

Claim 29 (previously presented): Apparatus according to claim 21 and wherein 
said set S2 comprises an expression including k functions that are derived from a 
univariate polynomial. 

Claim 30 (previously presented): Apparatus according to claim 29 and wherein 
said univariate polynomial includes a univariate polynomial of degree less than or 
equal to 100,000. 
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Claim 31 (previously presented): A signature verifier for verifying the digital 
signature generated by the signature generator of claim 18, the signature verifier 
comprising a verifier processor operative to perform the following operations: 

to obtain the signature ei,...5en+v5 th^ message, the hash function and 
the public key via the signature input receiver; 

to apply the hash function on the message to produce the series of k 
values bi,...,bk; and 

to verify that the equations Pi(ei,...,en+v5bi3---5bk)=0,..., Pk(ei,...,en+v, 
bb---5bk)=0 are satisfied. 

Claim 32 (previously presented): In an "Oil and Vinegar" signature generating 
apparatus an improvement characterized in that the "Oil and Vinegar" signature 
generating apparatus is operative to use more "vinegar" variables than "oil" 
variables. 

Claim 33 (currently amended): An "Oil and Vinegar" signature generating 
apparatus according to claim 32 and v^herein a number v of "vinegar" variables is 
selected to satisfy one of the following conditions: 

(a) for each characteristic p other than 2 of a field K and for a degree 
2 of an "Oil and Vinegar" signature method, v satisfies the inequality 
q(v-n)-i * ^ 2^0^ where n is a number of "oil" variables, K is a finite 
field from which the n "oil" variables and the v "vinegar" variables 
are selected, and q is the number of elements of K, 

(b) for p = 2 and for a degree 3 of the "Oil and Vinegar" signature 
method, v is greater than n*(l + sqrt(3)) and less than or equal to n^/6, 
and 

(c) for each p other than 2 and for a degree 3 of the "Oil and Vinegar" 
signature method, v is greater than n and less than or equal to n"^. 

Claim 34 (previously presented): An "Oil and Vinegar" signature generating 
apparatus according to claim 32 and wherein a number v of "vinegar" variables is 
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selected to satisfy the inequalities v<n^ and q^^'"^*' * n"* >2'*^ for a characteristic p=2 of 
a field K in an "Oil and Vinegar" scheme of degree 2, where n is a number of "oil" 
variables, K is a finite field from which the n "oil" variables and the v "vinegar" 
variables are selected, and q is the number of elements of K. 

Claim 35 (currently amended): A digital signature comprising: 

a signature ei,...,en+v generated by processing a set SI of k polynomial 
functions provided as a public-key and a message to be signed, where the set SI 
includes functions Pi(xi,...,Xn+v, yb-.^yk),.-., P+(?e^Trr;T?Wr^+v^^)^ Pk(xi,...,Xn+v, 
Yu'-'^YkX where k, v, and n are integers, Xi,...,Xn+v are n+v variables of a first type, 
yi,...,yk are k variables of a second type, and the set SI is obtained by applying a 
secret key operation on a set S2 of k polynomial functions 

P'i(ai,...,an+v,yi,....yk),".,P'k(ab...,an+v,yi,.-.,yk) where ai,...,an+v are n+v variables 
which include a set of n "oil" variables ai,...,an, and a set of v "vinegar" variables 
an+iv"5an+v5 and the number v of "vinegar" variables is greater than the number n of 
"oil" variables, so that a hash function applied on the message to produce a series of 
k values bi,...,bk that are substituted for the variables yi,...,yk of the set S2 
respectively to produce a set S3 of k polynomial functions P"i(ai,...,an+v)5-.-? 
P"k(a|,...,an+v) and v values a'n+i,...5a'n+v that are selected for the v "vinegar" 
variables an+;,...,an+v5 enable to solve a set of equations 
P"i(ai,...,an,a'n+i,-.,a'n+v)=0,..., P",,(ai,...,an,a'n+b.",a'n+v)=0 to obtain a solution for 
a'i,...,a'n, and application of the secret key operation transforms a'i,...,a'n+v into the 
digital signature ei,...,en+v. 

Claim 36 (previously presented): A digital signature produced by the method of 
claim 1. 

Claim 37 (previously presented): A method according to claim 1 and wherein said 
supplying comprises obtaining the set SI from a subset S2' of k polynomial 
functions of the set S2, the subset S2' being characterized in that all coefficients of 
components involving orders higher than 1 of any of the n "oil" variables ai,...,an 
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and coefficients of components involving multiplication of two or more of the n 
"oil" variables ai,...,an in the k polynomial functions P'i(ai,...,an+v.yi5.-.5ykX 
...,P'k(ai,...,an+v5yi, --syk) are zero, and the number v of "vinegar" variables is greater 
than the number n of "oil" variables. 

Claim 38 (previously presented): A method according to claim 37 and wherein the 
set S2 comprises a set S of k polynomial functions of a UOV scheme, and the 
number v of "vinegar" variables is selected to satisfy one of the following 
conditions: 

(a) for each characteristic p other than 2 of a field K in an "Oil and 
Vinegar" scheme of degree 2, v satisfies the inequality q^""*"^*** n"* > 
2"*^, where K is a finite field over which the sets SI, S2 and S3 are 
provided, 

(b) for p = 2 in an "Oil and Vinegar" scheme of degree 3, v is greater 
than n*(l + sqrt(3)) and less than or equal to n^/6, and 

(c) for each p other than 2 in an "Oil and Vinegar" scheme of degree 
3, V is greater than n and less than or equal to n"*. 

Claim 39 (previously presented): A method according to claim 37 and wherein the 
set S2 comprises a set S of k polynomial functions of a UOV scheme, and the 
number v of "vinegar" variables is selected to satisfy the inequalities v<n^ and q^^""^* 
^* n"^ >2^^ for a characteristic p=2 of a field K in an "Oil and Vinegar" scheme of 
degree 2, where K is a finite field over which the sets SI, S2 and S3 are provided 
and q is the number of elements of K. 

Claim 40 (previously presented): Apparatus according to claim 18 and wherein 
the set SI is obtained from a subset S2' of k polynomial functions of the set S2, the 
subset S2' being characterized in that all coefficients of components involving 
orders higher than 1 of any of the n "oil" variables ai,.,.,an and coefficients of 
components involving multiplication of two or more of the n "oil" variables ai,...,an 
in the k polynomial functions P'i(ai,...,an+v,yu....yk). ...,P'k(ai,...,an+v,yb...,yk) are 
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zero, and the number v of "vinegar" variables is greater than the number n of "oil" 
variables. 

Claim 41 (previously presented): Apparatus according to claim 40 and wherein 
the set S2 comprises a set S of k polynomial functions of a UOV scheme, and the 
number v of "vinegar" variables is selected to satisfy one of the following 
conditions: 

(a) for each characteristic p other than 2 of a field K in an "Oil and 
Vinegar" scheme of degree 2, v satisfies the inequality q^^""^"** n"* > 
2 , where K is a finite field over which the sets SI, S2 and S3 are 
provided, 

(b) for p = 2 in an "Oil and Vinegar" scheme of degree 3, v is greater 
than n*(l + sqrt(3)) and less than or equal to nV6, and 

(c) for each p other than 2 in an "Oil and Vinegar" scheme of degree 
3, V is greater than n and less than or equal to n"^. 

Claim 42 (previously presented): Apparatus according to claim 40 and wherein 
the set S2 comprises a set S of k polynomial functions of a UOV scheme, and the 
number v of "vinegar" variables is selected to satisfy the inequalities v<n^ and q^^'"^" 
>2^^ for a characteristic p=2 of a field K in an "Oil and Vinegar" scheme of 
degree 2, where K is a finite field over which the sets SI, S2 and S3 are provided 
and q is the number of elements of K. 
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